Today, storage apparatuses are used for storing data. Such a storage apparatus includes multiple hard disk drives (HDDs) and solid state drives (SSDs) to provide a large storage space. The storage apparatus is provided with various types of modules having predetermined functions in the storage apparatus, such as controlling access to the storage space, controlling communication with other apparatuses, and so on. The modules often have a redundant configuration for each function in order to increase the fault tolerance of each function.
For controlling operations of the modules, software called firmware is used. Firmware is often upgraded for enhancing functions and applying modifications. In view of this, there has been proposed a method that updates firmware being used on an apparatus.
For example, there has been proposed a technique that provides two central processing units (CPUs) in a controller module of a storage apparatus, and performs active replacement of firmware in units of CPUs. This prevents disconnection of a path between the controller module and the host during the replacement.
There has also been proposed a technique that updates a control program in units of modules in electronic equipment that operates in accordance with the control program. The control program includes a plurality of sets of program data as modules which respectively perform task management, memory management, input and output control, and so on.
Further, there has been proposed a technique that compares update processing times of three types of update processes, namely, a full update process, a partial update process, and a copy-and-update process, and selects the fastest update process, when updating old version software to new version software.
See, for example, Japanese Laid-open Patent Publications No. 2006-338217; No. 7-44393; and No. 2007-334636.
By utilizing a redundant configuration of modules provided in a storage apparatus, firmware may be updated without stopping operations of the storage apparatus. More specifically, after writing new version firmware to a non-volatile memory of each module, two systems having duplexed modules (two redundant modules) are sequentially rebooted one by one. When rebooted, each module loads the new version firmware to a volatile memory such as a random access memory (RAM) or the like provided in the module, and starts operating with the new version firmware. Even if the two modules operate with different versions of firmware, the two modules are able to appropriately cooperate with each other to maintain the redundant configuration as long as the different versions of firmware are compatible with each other.
However, in the case of updating firmware to a version (final update destination version) that is multiple versions apart from the current version, the current version is often incompatible with the final update destination version in terms of functions (for example, a function for controlling redundancy, and so on) provided by the firmware. After writing the firmware of the final update destination version to the two modules, if the method of sequentially rebooting two systems one by one is used, there will be a period during which one of the systems operates with the firmware of the final update destination version, and the other system operates with the firmware of the current version. If the functions provided by the firmware of the two systems are incompatible, the redundancy configuration of the two systems is lost, which might result in malfunction and a reduction in fault tolerance, for example. There may also be a method that sequentially updates the firmware of two systems one generation by one generation, for example. With this method, however, the number of times of replacing firmware is increased, which might increase the time taken to update the firmware.